Conventional local area networks (LANs) can be thought of as comprising a number of end stations (or terminals), connected to each other by a combination of links and switches. In addition, distant switches can be connected by virtual connections (VCs) passing through asynchronous transfer mode (ATM) switches. Such an extension of a LAN is often referred to as a LAN emulation over ATM (LANE) environment. As the number of end stations in the LAN or LANE environment grows, congestion of traffic and security issues become grave concerns of administrators of such networks.
Segmentation of the LAN or LANE environment into a number of virtual LANs (VLANs) has been used by network administrators to relieve traffic congestion and to provide security of information travelling within the network. The security provided by traditional VLANs is based on two basic principles used for transmitting data packets within the network. For one, broadcast and multicast traffic is transmitted only to end stations that are members of the VLAN. In this case, a known broadcast or multicast address can be shared among intended recipients. Secondly, unicast traffic is transmitted only between the source and destination end stations, although the location of an intended recipient can often only be determined by first broadcasting a "discovery" packet to other end stations within the VLAN. Clearly, network security in the prior art is based on the premise that data is transmitted only to those end stations that are authorized to see the data, thereby avoiding security breaches due to inadvertent or malicious snooping by end stations outside the VLAN. A serious flaw in this approach is that end stations can join a VLAN with little or no authentication by the network.
Membership in a VLAN can be defined by user name, access port identifier, end station media access control (MAC) address or Internet Protocol (IP) sub-network address. When membership in a VLAN is defined by access port identifier, a network administrator assigns the physical ports (e.g. on an Ethernet switch or hub) that constitute elements of a VLAN. However, this does not prevent an intruder from disconnecting a legitimate end station and connecting an illegitimate one to the same physical port. Once connected, the illegitimate end station has access to possibly confidential information circulating within the VLAN.
VLAN membership can also defined by referring to a unique 48-bit MAC address that is assigned to each end station during manufacture. In this case, the network administrator defines the MAC addresses of the end stations that constitute elements of the VLAN. When an end station is connected and begins transmitting data packets, the source MAC address contained in each data packet is used to determine the VLAN where the end station belongs. Unfortunately, this does not prevent an intruder from connecting an illegitimate end station to the network and inserting the MAC address of a legitimate end station into its data packets. Having successfully "emulated" a legitimate end station, the illegitimate end station gains access to restricted information being communicated in the VLAN.
Finally, the network administrator may also define the 32-bit IP address blocks or user names of the end stations that are permitted to be members of the VLAN. The IP address and user name act similarly to the MAC address, and again, by inserting the identity of a legitimate end station into its data packets, an illegitimate end station can gain access to restricted data.
It would thus be of prime importance to provide a method of ensuring that unauthorized end stations cannot connect to a VLAN. Furthermore, in the case where an authentication mechanism would be provided to alleviate this difficulty, it would be beneficial to ensure that unauthorized switches cannot emulate such an authentication mechanism.